Re: Re: White paper: "Many Eyes" - No Assurance Against Many Spies

[Tad Anhalt <tja () netins net>]

Crispin Cowan wrote:
> Ok, someone has mentioned Ken Thompson's Turing Award speech in a "my
>  security is better than yours" flamewar^W discussion. This almost 
> warrants a security-geek version of Godwin's law :)

  That's fine.  I didn't bring it up, the original article did.  I still do
think anybody who touches code should at least read it and think about
what it means.

  If somebody wants to turn this into a flame war, carry on.  I'll move
along.  No need to invoke anything at this point.

> For a really interesting long-term extrapolation of this point of 
> view, I strongly recommend reading "A Deepness in the Sky" by Vernor
>  Vinge http://www.tor.com/sampleDeepness.html

  Good book, yes I would recommend it as well.  "A Fire Upon the Deep"
is also both a good read and further explores the concept of how
dangerous it is to play with "hardware" that you don't understand.

> It also leads to the classic security analysis technique of amassing 
> *all* the threats against your system, estimating the probability and
> severity of each threat, and putting most of your resources against
> the largest threats. IMHO if you do that, then you discover that
> "Trojans in the Linux code base" is a relatively minor threat

  Yes, that's where I would hope most professionals would end up.  I've
often wondered how many people end up with "Oh, well, I guess it
doesn't matter anyway..."

> compared to "crappy user passwords", "0-day buffer overflows", and 
> "lousy Perl/PHP CGIs on the web server". This Ken Thompson gedanken 
> experiment is fun for security theorists, but is of little practical
>  consequence to most users.

  The article wasn't about installing software for "most users,"  but
rather about what sort of software is appropriate for networked devices
on a battlefield.

  Yes, it read like a advertisement.  Yes, it specifically singled out
"linux" and "open source" where there was no need to.   Yes, it used a
ton of overblown and bad analogies...

  I was hoping for a discussion to emerge about building software for
similar environments.  If network devices deployed in a battle zone
isn't the right cup of tea, how about health monitors that will be
hooked to a hospital network?  Software that will run on devices
intended on being imbedded inside the body ala pacemakers or coclear
implants.  Voting machines.  ABS systems, airbag controllers.  ATM
machines...

  The risks forum (http://catless.ncl.ac.uk/Risks) does a good job
detailing the problems that can arise when developing these systems, but
isn't as geared towards detailed discussions of reasonable solutions to
those problems...  I was hoping this list might be a better place for
discussions of that nature.

Tad Anhalt